Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Security Content] 8.3 Add Investigation Guides - 3 #1990

Merged
merged 6 commits into from
May 31, 2022
Merged

[Security Content] 8.3 Add Investigation Guides - 3 #1990

merged 6 commits into from
May 31, 2022

Conversation

w0rk3r
Copy link
Contributor

@w0rk3r w0rk3r commented May 23, 2022

Summary

Adds Investigation guides to the following rules:

  • Clearing Windows Console History
  • Clearing Windows Event Log
  • Windows Event Logs Cleared
  • Disable Windows Event and Security Logs Using Built-in Tools
  • Enable Host Network Discovery via Netsh
  • Windows Firewall Disabled via PowerShell
  • Execution of File Written or Modified by Microsoft Office
  • Execution of File Written or Modified by PDF Reader
  • Potential Lateral Tool Transfer via SMB Share (Renamed from: "Lateral Tool Transfer")
  • Account configured with never Expiring Password

@w0rk3r w0rk3r added Rule: Tuning tweaking or tuning an existing rule OS: Windows windows related rules Domain: Endpoint Security Content labels May 23, 2022
@w0rk3r w0rk3r self-assigned this May 23, 2022
terrancedejesus
terrancedejesus approved these changes May 24, 2022
View reviewed changes
Copy link
Contributor

@terrancedejesus terrancedejesus left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approving so it is ready to merge when needed.

nastasha-solomon
nastasha-solomon reviewed May 26, 2022
View reviewed changes
Copy link
Contributor

@nastasha-solomon nastasha-solomon left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Left some comments for your consideration. Thanks for your work on this @w0rk3r !

rules/windows/defense_evasion_clearing_windows_console_history.toml Outdated Show resolved Hide resolved
rules/windows/defense_evasion_clearing_windows_event_logs.toml Outdated Show resolved Hide resolved
rules/windows/defense_evasion_clearing_windows_event_logs.toml Outdated Show resolved Hide resolved
rules/windows/defense_evasion_enable_network_discovery_with_netsh.toml Outdated Show resolved Hide resolved
rules/windows/defense_evasion_clearing_windows_security_logs.toml Outdated Show resolved Hide resolved
rules/windows/persistence_dontexpirepasswd_account.toml Outdated Show resolved Hide resolved
rules/windows/persistence_dontexpirepasswd_account.toml Outdated Show resolved Hide resolved
rules/windows/persistence_dontexpirepasswd_account.toml Outdated Show resolved Hide resolved
rules/windows/persistence_dontexpirepasswd_account.toml Show resolved Hide resolved
rules/windows/persistence_dontexpirepasswd_account.toml Show resolved Hide resolved
@w0rk3r
Copy link
Contributor Author

w0rk3r commented May 31, 2022

Hey @nastasha-solomon & @joepeeples, can I get a final review on this one to merge?

@w0rk3r w0rk3r requested a review from nastasha-solomon May 31, 2022 10:24
joepeeples
joepeeples reviewed May 31, 2022
View reviewed changes
Copy link
Contributor

@joepeeples joepeeples left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added a few small suggestions, but otherwise LGTM!

rules/windows/defense_evasion_enable_network_discovery_with_netsh.toml Outdated Show resolved Hide resolved
rules/windows/defense_evasion_powershell_windows_firewall_disabled.toml Outdated Show resolved Hide resolved
rules/windows/execution_ms_office_written_file.toml Outdated Show resolved Hide resolved
rules/windows/execution_pdf_written_file.toml Outdated Show resolved Hide resolved
rules/windows/lateral_movement_executable_tool_transfer_smb.toml Outdated Show resolved Hide resolved
rules/windows/persistence_dontexpirepasswd_account.toml Outdated Show resolved Hide resolved
rules/windows/persistence_dontexpirepasswd_account.toml Outdated Show resolved Hide resolved
@w0rk3r w0rk3r merged commit 27f5c2e into main May 31, 2022
@w0rk3r w0rk3r deleted the investigation_guides_8.3_3 branch May 31, 2022 15:57
protectionsmachine pushed a commit that referenced this pull request May 31, 2022
@w0rk3r @github-actions
[Security Content] 8.3 Add Investigation Guides - 3 (#1990)
e9117f9 
* [Security Content] 8.3 Add Investigation Guides - 3

* bump date

* Apply suggestions from code review

Co-authored-by: nastasha-solomon <[email protected]>

* Apply suggestions from code review

Co-authored-by: Joe Peeples <[email protected]>

Co-authored-by: nastasha-solomon <[email protected]>
Co-authored-by: Joe Peeples <[email protected]>

(cherry picked from commit 27f5c2e)
protectionsmachine pushed a commit that referenced this pull request May 31, 2022
@w0rk3r @github-actions
[Security Content] 8.3 Add Investigation Guides - 3 (#1990)
4bcfcd1 
* [Security Content] 8.3 Add Investigation Guides - 3

* bump date

* Apply suggestions from code review

Co-authored-by: nastasha-solomon <[email protected]>

* Apply suggestions from code review

Co-authored-by: Joe Peeples <[email protected]>

Co-authored-by: nastasha-solomon <[email protected]>
Co-authored-by: Joe Peeples <[email protected]>

(cherry picked from commit 27f5c2e)
protectionsmachine pushed a commit that referenced this pull request May 31, 2022
@w0rk3r @github-actions
[Security Content] 8.3 Add Investigation Guides - 3 (#1990)
035842c 
* [Security Content] 8.3 Add Investigation Guides - 3

* bump date

* Apply suggestions from code review

Co-authored-by: nastasha-solomon <[email protected]>

* Apply suggestions from code review

Co-authored-by: Joe Peeples <[email protected]>

Co-authored-by: nastasha-solomon <[email protected]>
Co-authored-by: Joe Peeples <[email protected]>

(cherry picked from commit 27f5c2e)
protectionsmachine pushed a commit that referenced this pull request May 31, 2022
@w0rk3r @github-actions
[Security Content] 8.3 Add Investigation Guides - 3 (#1990)
1484c20 
* [Security Content] 8.3 Add Investigation Guides - 3

* bump date

* Apply suggestions from code review

Co-authored-by: nastasha-solomon <[email protected]>

* Apply suggestions from code review

Co-authored-by: Joe Peeples <[email protected]>

Co-authored-by: nastasha-solomon <[email protected]>
Co-authored-by: Joe Peeples <[email protected]>

(cherry picked from commit 27f5c2e)
protectionsmachine pushed a commit that referenced this pull request May 31, 2022
@w0rk3r @github-actions
[Security Content] 8.3 Add Investigation Guides - 3 (#1990)
3d88c51 
* [Security Content] 8.3 Add Investigation Guides - 3

* bump date

* Apply suggestions from code review

Co-authored-by: nastasha-solomon <[email protected]>

* Apply suggestions from code review

Co-authored-by: Joe Peeples <[email protected]>

Co-authored-by: nastasha-solomon <[email protected]>
Co-authored-by: Joe Peeples <[email protected]>

(cherry picked from commit 27f5c2e)
protectionsmachine pushed a commit that referenced this pull request May 31, 2022
@w0rk3r @github-actions
[Security Content] 8.3 Add Investigation Guides - 3 (#1990)
1269a98 
* [Security Content] 8.3 Add Investigation Guides - 3

* bump date

* Apply suggestions from code review

Co-authored-by: nastasha-solomon <[email protected]>

* Apply suggestions from code review

Co-authored-by: Joe Peeples <[email protected]>

Co-authored-by: nastasha-solomon <[email protected]>
Co-authored-by: Joe Peeples <[email protected]>

(cherry picked from commit 27f5c2e)
protectionsmachine pushed a commit that referenced this pull request May 31, 2022
@w0rk3r @github-actions
[Security Content] 8.3 Add Investigation Guides - 3 (#1990)
d4ea52b 
* [Security Content] 8.3 Add Investigation Guides - 3

* bump date

* Apply suggestions from code review

Co-authored-by: nastasha-solomon <[email protected]>

* Apply suggestions from code review

Co-authored-by: Joe Peeples <[email protected]>

Co-authored-by: nastasha-solomon <[email protected]>
Co-authored-by: Joe Peeples <[email protected]>

(cherry picked from commit 27f5c2e)
@terrancedejesus terrancedejesus mentioned this pull request Jun 20, 2022
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@joepeeples joepeeples joepeeples left review comments

@terrancedejesus terrancedejesus terrancedejesus approved these changes

@imays11 imays11 imays11 approved these changes

@Mikaayenson Mikaayenson Awaiting requested review from Mikaayenson

@brokensound77 brokensound77 Awaiting requested review from brokensound77

@DefSecSentinel DefSecSentinel Awaiting requested review from DefSecSentinel

@jmikell821 jmikell821 Awaiting requested review from jmikell821

@Samirbous Samirbous Awaiting requested review from Samirbous

@benironside benironside Awaiting requested review from benironside

@nastasha-solomon nastasha-solomon Awaiting requested review from nastasha-solomon

Assignees

@w0rk3r w0rk3r

Labels
backport: auto Domain: Endpoint OS: Windows windows related rules Rule: Tuning tweaking or tuning an existing rule Security Content
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@w0rk3r @imays11 @nastasha-solomon @joepeeples @terrancedejesus